Merge Hotfix20200121: isURLInPortal could be tricked into accepting malicious links.
